# encoding: utf-8
require "logstash/filters/base"
require "logstash/namespace"
require "logstash/environment"
class LogStash::Filters::SimpleDelta < LogStash::Filters::Base

  config_name("simpledelta")
  milestone 1

  config :match_oper, :validate => ["include","regex"], :default => 'include'
  config :match_field, :validate => :string, :default => 'message'
  config :input_field, :validate => :string
  config :output_field, :validate => :string, :default => 'delta'

  config :pattern, :validate => :string #required for match_oper=='regex'
  config :keywords, :validate => :array, :required => false #required for match_oper=='include'
  config :match_keywards, :validate => :array
  
  public
  def register 
    @kv_dict = {} #value kept in last event with same kv
  end # def register

  public
  def filter(event)
#    event['echo_match_field'] = event[@match_field]
#    event['echo2'] = event['value']
#    event['debug3'] = type(event)
#    matched = false
    
    if match_oper == 'include' #include match 
#        all_keyvalues_matched = true
        has_input_field = event.include?(@input_field)
        all_keywords_exists = true
        combined_key = ''
        @keywords.each do |kw|
#            event['debug'] = event[kw.to_s]
#            event['debug2'] = kw.to_s
            combined_key += event[kw.to_s].to_s
            if !event.include?(kw.to_s)
                all_keywords_exists = false
                break
            end
#            else #if there is this fields, compare the value then
#                if !@lastEvent.nil? and !(event[kw.to_s] == @lastEvent[kw.to_s])
#                    all_keywords_matched = false
#                end
#            end
        end
        event['all_keywords_exists'] = all_keywords_exists
        event['has_input_field'] = has_input_field
        if has_input_field and all_keywords_exists
            event['debug_1'] = combined_key
#            @keywords.each do |kw|
#                event['debug_hasKey:' + combined_key] = kv_dict.has_key?(combined_key)
                if @kv_dict.has_key?(combined_key)
                    event['debugHasKey'] = true
                    event[@output_field] = event[@input_field].to_f - @kv_dict[combined_key].to_f
#                    kv_dict[combined_key] = event[@input_field].to_f
                end
                
                @kv_dict[combined_key] = event[@input_field].to_f
                event['debug_2'] = @kv_dict.to_s
#                if !@lastEvent.nil? 
#                    kv = event[kw.to_s]
#                end
#                kv_dict[kw.to_s] = event[@input_field].to_f
#            end
        end
#        matched = all_keywords_matched
    end #end of include match
     
#    if match_oper == 'regex' #regex match
#        @regex_pattern = Regexp.new(@pattern)
#        if event[@match_field] =~ @regex_pattern
#            matched = true
#            event['debug'] = 'matched'
#        end
#    end #end of regex match

#     event['matched'] = matched
#     if !@lastEvent.nil? and matched
#        event[@output_field] = 
#         (event[@input_field].to_f) - (@lastEvent[@input_field]).to_f  
#     else
#       event[@output_field] = 0     
#     end
#
#     # remember event for next time
#    #@lastEvent = event
#     if matched
#        @lastEvent = event
#     end
       
  end # def filter

end # class LogStash::Filters::SimpleDelta
